CLAIMS 

What is claimed is: 

1 ■ A method of protecting and execxiting executable files, the method conqirising: 

protecting an executable file through either of compression and encryption; 

incorporating a protection descriptor into said executable file, said protection 
descriptor including information required for unprotecting said executable file; 

providing said protected executable file to uiqjrotection and execution apparatus 
operative to unprotect said executable file; 

unprotecting said protected executable file at said unprotection and execution 
apparatus using said protection descriptor; and 

executing said unprotected executable file at said unprotection and execution 

apparatus, 

2, A method according to claim 1 wherein said incorporating step comprises including 

either of a coinpression key and an encryption key required to uncompress or decrypt said 
protected executable file in said protection descriptor. 

3- A method according to claim 1 and fiirther conoprising encrypting said protection 

descriptor. 

4. A method according to claim 1 wherein said providing step comprises providing said 

protected executable file to an interpreter. 



12 



5. A method according to claim 4 wherein said executable file is an ELF executable file 

and wherein said interpreter is an ELF interpreter, 

6' A method according to claim 4 wherein said unprotecting step further comprises 

checking said protected executable JSle for the presence of non-standard program code and 
unprotecting said protected executable file only when said non-standard program code is present 
in said protected executable file, 

7. A method according to claim 1 wherein said providing step comprises providing said 
protected executable file to a kernel module. 

8. A method of protecting and executing executable files, the method comprising: 
protecting at least one fimction within an executable file through either of 

compression and encryption, thereby creating a protected portion corresponding to said at least 
one fimction; 

preceding said protected portion with a function call instruction to a dynamic 
unprotector; 

executing said fimction call instruction, thereby executing said dynamic unprotector; 
unprotecting, at said dynamic unprotector, said protected portion, thereby creating an 
unprotected portion; 

overwriting said fimction call instruction and said protected portion with said 
unprotected portion; and 

executing said unprotected portion. 
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9- A method according to claim 8 and fiirther comprising incoiporating into said 

executable file a list identifying said protected function, said list describing any of the fimction 
length of said fiinction, the compression method used to protect said function, the encryption 
method used to protect said fiinction, and a key required to unprotect said protected portion, 
wherein said unprotecting step comprises unprotecting using any information in said list, 

10. A method according to claim 8 and fiirther comprising providing said executable file 
to unprotection and execution apparatus, and wherein said executing, unprotecting, and 
overwriting steps are performed by said unprotection and execution apparatus. 

11. A method according to claim 10 wherein said protecting step comprises protecting 
said at least one fimction within an executable file, and wherein said providing step comprises 
providing said executable file to an interpreter. 

12. A method according to claim 1 1 wherein said executable file is an ELF executable file 
and wherein said interpreter is an ELF interpreter. 



13. A method of protecting and executing executable files, the method conqsrising: 

hashing at least one static portion of an executable file, thereby creating a 
cryptographic digest; 

encrypting, using said cryptographic digest, at least one execution parameter 
necessary for the execution of said executable file; 

storing said encrypted execution parameter in said executable file; 
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hashing said at least one static portion of said executable file, thereby recreating said 
cryptographic digest; 

decrypting, using said cryptographic digest, said at least one encrypted execution 
parameter; and 

executing said executable ffle using said decrypted execution parameter. 

14. A method according to claim 13 wherein said encrypting step comprises encrypting 
the address of an instruction that represents the entry point for execution of said executable file. 

15. A method according to claim 13 wherein said first hashing, enctypting, and storing 
steps are performed on a first computer, and wherein said second hashing, decrypting, and 
executing steps are performed on a second computer. 

16. A method according to claim 13 and fiirther comprising providing said executable file 
to tinprotection and execution apparatus, and wherein said first hashing, encrypting, and storing 
steps are performed by said unprotection and execution apparatus. 

17. A method according to claim 16 wherein said first hashing, encrypting, and storing 
steps are performed on an executable file, and wherein said providing step comprises providing 
said executable file to an interpreter. 

18. A method according to claim 17 wherein said executable file is an ELF executable file 
and wherein said interpreter is an ELF interpreter. 
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